II - Mission Support Sensitive
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000033-DB-000084
<GroupDescription></GroupDescription>Group -
SQL Server must enforce approved authorizations for logical access to information and database-level system resources in accordance with applicable access control policies.
<VulnDiscussion>Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access the database and all it...Rule Medium Severity -
SRG-APP-000089-DB-000064
<GroupDescription></GroupDescription>Group -
SQL Server must generate Trace or Audit records for organization-defined auditable events.
<VulnDiscussion>Audit records can be generated from various components within the information system (e.g., network interface, hard disk, mod...Rule Medium Severity -
SRG-APP-000090-DB-000065
<GroupDescription></GroupDescription>Group -
Where SQL Server Audit is in use at the database level, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited at the database level.
<VulnDiscussion>Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel ma...Rule Medium Severity -
SRG-APP-000133-DB-000179
<GroupDescription></GroupDescription>Group -
SQL Server must be monitored to discover unauthorized changes to functions.
<VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware component...Rule Medium Severity -
SRG-APP-000133-DB-000179
<GroupDescription></GroupDescription>Group -
SQL Server must be monitored to discover unauthorized changes to triggers.
<VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware component...Rule Medium Severity -
SRG-APP-000133-DB-000179
<GroupDescription></GroupDescription>Group -
SQL Server must be monitored to discover unauthorized changes to stored procedures.
<VulnDiscussion>When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware component...Rule Medium Severity -
SRG-APP-000133-DB-000200
<GroupDescription></GroupDescription>Group -
Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership.
<VulnDiscussion>Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access t...Rule Medium Severity -
SRG-APP-000133-DB-000200
<GroupDescription></GroupDescription>Group -
In a database owned by a login not having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF unless required and authorized.
<VulnDiscussion>SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if ...Rule Medium Severity -
SRG-APP-000133-DB-000200
<GroupDescription></GroupDescription>Group -
In a database owned by [sa], or by any other login having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF.
<VulnDiscussion>SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if ...Rule Medium Severity -
SRG-APP-000226-DB-000147
<GroupDescription></GroupDescription>Group -
In the event of a system failure, SQL Server must preserve any information necessary to return to operations with least disruption to mission processes.
<VulnDiscussion>Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Th...Rule Medium Severity -
SRG-APP-000231-DB-000154
<GroupDescription></GroupDescription>Group -
The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
<VulnDiscussion>When not encrypted by the Service Master Key, system administrators or application administrators may access and use the Data...Rule Medium Severity -
SRG-APP-000231-DB-000154
<GroupDescription></GroupDescription>Group -
Database Master Key passwords must not be stored in credentials within the database.
<VulnDiscussion>Storage of the Database Master Key password in a database credential allows decryption of sensitive data by privileged users ...Rule Medium Severity -
SRG-APP-000231-DB-000154
<GroupDescription></GroupDescription>Group -
Symmetric keys (other than the database master key) must use a DoD certificate to encrypt the key.
<VulnDiscussion>Data within the database is protected by use of encryption. The symmetric keys are critical for this process. If the symmetri...Rule Medium Severity -
SRG-APP-000243-DB-000128
<GroupDescription></GroupDescription>Group -
Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
<VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the ac...Rule Medium Severity -
SRG-APP-000251-DB-000160
<GroupDescription></GroupDescription>Group -
SQL Server must check the validity of all data inputs except those specifically identified by the organization.
<VulnDiscussion>Invalid user input occurs when a user inserts data or characters into an application’s data entry fields and the application ...Rule Medium Severity -
SRG-APP-000251-DB-000391
<GroupDescription></GroupDescription>Group -
The DBMS and associated applications must reserve the use of dynamic code execution for situations that require it.
<VulnDiscussion>With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection...Rule Medium Severity -
SRG-APP-000251-DB-000392
<GroupDescription></GroupDescription>Group -
The DBMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
<VulnDiscussion>With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection...Rule Medium Severity -
SRG-APP-000266-DB-000162
<GroupDescription></GroupDescription>Group -
The DBMS and associated applications must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
<VulnDiscussion>Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromis...Rule Medium Severity -
SRG-APP-000267-DB-000163
<GroupDescription></GroupDescription>Group -
SQL Server must reveal detailed error messages only to the ISSO, ISSM (or their designees), SA and DBA.
<VulnDiscussion>If the DBMS provides too much information in error logs and administrative messages to the screen, this could lead to comprom...Rule Medium Severity -
SRG-APP-000311-DB-000308
<GroupDescription></GroupDescription>Group -
When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in storage.
<VulnDiscussion>Without the association of security labels to information, there is no basis for the DBMS to make security-related access-con...Rule Medium Severity -
SRG-APP-000313-DB-000309
<GroupDescription></GroupDescription>Group -
When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in process.
<VulnDiscussion>Without the association of security labels to information, there is no basis for the DBMS to make security-related access-con...Rule Medium Severity -
SRG-APP-000314-DB-000310
<GroupDescription></GroupDescription>Group -
When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission.
<VulnDiscussion>Without the association of security labels to information, there is no basis for the DBMS to make security-related access-con...Rule Medium Severity -
SRG-APP-000375-DB-000323
<GroupDescription></GroupDescription>Group -
Time stamps in database tables, intended for auditing or activity-tracking purposes, must include both date and time of day, with a minimum granularity of one second.
<VulnDiscussion>If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analys...Rule Medium Severity -
SRG-APP-000428-DB-000386
<GroupDescription></GroupDescription>Group -
SQL Server must implement and/or support cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
<VulnDiscussion>Databases holding data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disc...Rule Medium Severity -
SRG-APP-000447-DB-000393
<GroupDescription></GroupDescription>Group -
When invalid inputs are received, SQL Server must behave in a predictable and documented manner that reflects organizational and system objectives.
<VulnDiscussion>A common vulnerability is unplanned behavior when invalid inputs are received. This requirement guards against adverse or uni...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.